Showing posts with label tumblr. Show all posts
Showing posts with label tumblr. Show all posts

Friday, October 28, 2011

Poor Princess Leia! Tumblr.com CSRF domain hijack


Tumblr.com is a microblogging platform with over 32 millions of users, with Alexa global rank of 45. Tumblr.com had a CSRF vulnerability on blog settings page
http://tumblr.com/tumblelog/[blog-name]/settings that allowed for launching targeted attacks against a specified blog to hijack its domain and perform other potentially severe actions on behalf of a victim user.